Let agents in.
Keep the flood out.
Bond is a refundable-deposit layer for AI agents. Your agents get through bonded doors with one MCP tool. Your inboxes, forms and endpoints put a price on abuse, with no accounts and no CAPTCHAs. Honest use is refunded.
$ claude mcp add --transport http bond https://bond.elsisi.workers.dev/mcpFree identities broke every gate.
Every defence we have assumes a human, or an identity that is expensive to make. Agents create both for free, at any volume. Inboxes, forms, issue trackers and public tools are open sinks.
CAPTCHAs
Models solve them. They now mostly stop the humans.
Rate limits and API keys
An agent mints a new key or account for every batch. The limit follows the identity, and identities are free.
Blocklists and reputation
New sender, new domain, clean slate. You are always one step behind.
Two sides. One deposit.
Install it on the agents that send. Put it in front of the things that receive. Both work today in test mode.
Your agents send
- Add the MCP server to Claude Code, Cursor or any MCP client.
- The agent calls bond_terms, then bond_send. The 402 and the deposit are handled for it.
- The message is delivered. The hold is released unless it was junk.
# one line claude mcp add --transport http bond \ https://bond.elsisi.workers.dev/mcp # the agent now has bond_send(alias, from, subject, text) bond_terms(alias) # base bond + release rate
- Get through bonded doors other agents are blocked at
- Spend is a hold that comes back when work is genuine
- Check a recipient's release rate before paying
Your things receive
- Claim a gate in 30 seconds. You get a bonded link and an API address.
- Point contact forms, issue templates or agent traffic at it.
- Paid messages land in Slack, Discord or your webhook, or in the built-in inbox.
- Decide in one click, or write rules and let an AI triage agent recommend.
# any HTTP client, no accounts POST /api/send/yourname <- 402 { "amount_cents": 100, "pay_url": ... } # bonded message arrives in Slack: [$1.00 bond] Question about your API Worth it: https://.../d/eyJ0... Junk: https://.../d/eyJ0...
- A price on abuse, with no CAPTCHA and no blocklist
- Junk pays you. Good senders are refunded
- Every gate shows its release rate to senders
Where it earns its keep.
Four places where agents already outnumber humans and nothing prices the traffic.
An SDR agent contacting 300 prospects
Prospects who use Bond require a deposit. The agent, given the MCP tool, posts about $1 per genuine, specific message and it comes back when read. Templated blasts are priced higher, so the agent learns to write for the person.
Stopping AI-generated issues and PRs
Link the bonded form from your CONTRIBUTING file and send paid reports to Slack. Real contributors get the deposit back on a merged or valid report. Drive-by bot reports cost them.
A 402 in front of an open tool
A public tool gets hammered by anonymous agents. Front it with a bonded gate: callers stake a deposit for a session, abuse forfeits it. Drop-in middleware for Cloudflare Workers.
AI apply-bots flooding job posts
Applicants place a small refundable deposit; anyone a human or screening agent reviews gets it back. Mass auto-applications stop being free.
A hosted agent paid a bond without help.
We pointed a Brainbase-hosted agent at Bond with one instruction: read the protocol and reach the inbox. It fetched the docs, hit the 402, read the recipient's 17% release rate, judged it worth the risk, paid a $1 test hold and delivered a genuine message. Nobody wrote its payment code.
GET /agents.md 200 POST /api/send/demo 402 amount_cents: 100 GET <pay_url> Accept: json 402 release_rate: 0.17 POST <pay_url>/pay 200 status: held -> delivered
What happens to a deposit.
402How it can be abused, and what stops it.
A paid gate invites new tricks. Each one we found, and what we did.
Every gate publishes its release rate, and agents can read it before paying. Daily capture cap per owner; extra junk marks release instead.
Rate limits per bond and IP, Stripe-hosted card entry, holds not charges.
Claude only suggests a price in a fixed range. The triage agent gets a one-hour token that can recommend but never move money.
Webhooks must be HTTPS to public hosts, redirects are not followed, and private addresses are rejected.
Web, API and MCP intake ignore the approved-senders list, because those addresses are self-declared.
Signed, expiring decision links. Viewing never acts. The public feed hides subjects and full addresses.
Per-agent budgets and a spend cap in the MCP tool. Holds already expire and release on their own.
Minimum deposit floor for captures; limits per card fingerprint; repeated near-identical messages already cost more.
Live now, and next.
Protect something in 30 seconds.
- 1Pick a name and your base deposit. Nothing to install.
- 2You land in your dashboard with your link ready to copy.
- 3Add a Slack or Discord webhook, or just watch the inbox.
Prototype in Stripe test mode. Use card 4242 4242 4242 4242 to try the paying side.
Good questions.
Why would anyone pay to reach me?
They put down a deposit, not a fee. If the message is genuine it comes back, so honest senders and honest agents lose nothing. It only costs money to those who send junk at scale, which is the goal.
Why not just charge per call, like x402?
Per-call fees tax the honest traffic too. A refundable deposit prices abuse without taxing good behavior, and it needs no per-call micropayments. The two ideas are compatible.
How does Bond make money?
Not from junk. Plans: a subscription for teams, a per-deposit fee for developers who gate forms and APIs, and a small cut of captured deposits above a minimum.
Does Claude control the money?
No. Claude reads a message and suggests a price within a fixed range. Holds, releases and captures are deterministic code, and the triage agent can only recommend.
Is this real money?
Not yet. This is a hackathon prototype in Stripe test mode. No real cards are charged.